X / xAI · disclosed reports
Cross-site Scripting
45 disclosed reports · $7,560 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open X / xAI on HackerOne- reports
- 45
- paid a bounty
- 8
Every one of the 45 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Blind XSS on Twitter's internal Big Data panel at █████████████
- XSS via Direct Message deeplinks
- Stored XSS on reports.
- Account Takeover in Periscope TV
- XSS and cache poisoning via upload.twitter.com on ton.twitter.com
- Reflected XSS in twitterflightschool.com
- XSS via referrer parameter
- Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive data
- Persistent DOM-based XSS in https://help.twitter.com via localStorage
- Html Injection and Possible XSS in sms-be-vip.twitter.com
- Multiple XSS on account settings that can hijack any users in the company.
- Multiple DOMXSS on Amplify Web Player
- Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent)
- csp bypass + xss
- DOMXSS in Tweetdeck
- URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWS
- Cross-site scripting (reflected)
- Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506
- CRLF and XSS stored on ton.twitter.com
- File Upload XSS in image uploading of App in mopub
- XSS on OAuth authorize/authenticate endpoint
- Stored XSS in https://app.mopub.com
- XSS using javascript:alert(8007)
- xss in link items (mopub.com)
- Html Injection and Possible XSS via MathML
- [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.